Bug › Module 1 › Lesson 2
Legal Safe Harbor
Safe harbor protects researchers who follow program rules — read YOUR program policy for $SCOPE_HOST before any probe.
Visual · bounty_legal_safe_harbor
Safe harbor = follow program rules. $SCOPE_HOST only. Original Cyberlium.
Opening
Program policy is your authorization document. Safe harbor lives inside it — not outside.
Bug bounty programs publish policies describing in-scope assets, allowed techniques, rate limits, forbidden actions, and safe harbor language protecting good-faith researchers who stay within rules. Safe harbor does not cover out-of-scope hosts, destructive attacks, privacy violations, or social engineering unless explicitly permitted. Cyberlium teaches safe harbor literacy on programs YOU joined — $SCOPE_HOST placeholder. You do not copy a public policy and aim it at a school network or classmate project. Next: Never Out-of-Scope.
1. Safe harbor requires good-faith rule-following
Safe harbor clauses typically protect researchers who test only in-scope assets, avoid prohibited techniques, respect rate limits, and report through official channels. Violating scope, exfiltrating excessive data, or attacking third parties can void protection.
Before any recon on $SCOPE_HOST, screenshot or save the current program policy date, scope list, and safe harbor section. Policies change — stale notes create legal risk.
Command guide
Try these commands — Safe harbor requires good-faith rule-following
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Safe harbor — program policy defines legal testing window OWASP testing — https://owasp.org/www-project-web-security-testing-guide/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
curl -sS https://www.bugcrowd.com/resources | head -5 grep safe_harbor "$HOME/cyberlium-lab/t20-rules.txt" 2>/dev/null || echo 'Write t20-rules.txt in 1-4'
Primary tools to practice this lesson: curl, grep. Reference sites: Safe harbor; OWASP testing (https://owasp.org/www-project-web-security-testing-guide/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Program policy beats forum advice
Discord tips, Reddit threads, and old blog posts do not override the live program page. If the policy says 'no automated scanning on production API,' that rule applies even when a tutorial ignores it.
Professional researchers bookmark program URLs and re-read scope before each session. Steal the habit and leave stranger networks alone.
3. Safe harbor is not a blank check
Joining a program does not authorize testing unlisted subdomains, third-party integrations, or employee personal accounts unless scope explicitly includes them. When in doubt, ask the program through official channels — do not 'just try.'
Ship: one-line summary of safe harbor for YOUR enrolled program at $SCOPE_HOST. Next lesson names hard out-of-scope stops.
4. What you ship: safe harbor summary for YOUR program
Summarize safe harbor + key rules from program YOU joined. $SCOPE_HOST named. NEVER random sites. chmod 600.
5. What you record before the next lesson
Date. Safe harbor summary. $SCOPE_HOST program named. File t20-m01-l02-legal-safe-harbor.txt chmod 600.
6. Wrong vs right: random sites vs in-scope program
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Assume any HackerOne account authorizes all HackerOne targets. Ignore rate limits because 'safe harbor covers it.'
Right
Summarize safe harbor for YOUR $SCOPE_HOST program. Next: Never Out-of-Scope.
Mission: read safe harbor on YOUR program
1) Open the program page for $SCOPE_HOST you joined. 2) Write three safe harbor / rule lines in your own words. 3) Note policy date. 4) chmod 600. Never test assets not listed in that policy.
Stuck? Ask Cyberlium AI Mentor
Safe harbor protects rule-followers — scope violations can void it instantly.
Knowledge Check
APPLY: Safe harbor on a bounty program typically requires:
Multiple choice
Knowledge Check
APPLY: True or False: Old forum advice overrides the live program policy.
True or False
Knowledge Check
APPLY: Before testing $SCOPE_HOST you should:
Multiple choice